Lord Adonis: My Lords, the noble Baroness, Lady Ludford, has raised some important points. It is totally unjustifiable that there is no impact assessment for this regulation; I hope that the Minister will address and explain that. The noble Baroness also made an important point about the way that data adequacy will be assessed if we are outside the EU, particularly in a no-deal scenario.
I will extend that to cover my perennial theme of consultation. No issue affects businesses and individuals across the country more than data. Indeed, we went through the whole GDPR exercise precisely because this is so central to our individual and community life. The fact that there has been no consultation at all on this regulation seems truly indefensible, so I hope that the Minister will say why that has been the case. The noble Lord, Lord McNally, said that data is now  the new oil. He is absolutely right; it is as important to the functioning of our economy and our society as energy—it is a form of energy—and there clearly should have been consultation. Can the Minister say why there was no consultation? I assume that he will tell us again that there was no time, which begs the question of why we are going through this no-deal process at all if there is not time to conduct the normal processes of government in respect of it.
As ever, there is a bizarre twist to the statement on consultation. Paragraph 10 of the Explanatory Memorandum states:
“The government has not consulted publicly on this instrument”.
I presume that that means that they have consulted privately, and the House needs to know who has been consulted privately. The only body mentioned in paragraph 10 is the Information Commissioner’s Office, with which, it states, the regulation has been developed in consultation. Who else has been consulted privately and what were the selection criteria? Since the regulation was published, there have been representations. What representations have been made to the Minister’s department and what was their content?
The noble Baroness, Lady Ludford, also raised the issue of trying to assess the impact. Again we have doublespeak in respect of the regulations. We are told that their literal interpretation means that there is no further impact over and above the operation of existing European law. However, that is after, in the words of the White Queen in Alice in Wonderland, you have believed six impossible things before breakfast. Paragraph 12, entitled, “Impact”, states:
“There is no, or no significant, impact on business, charities or voluntary bodies arising from this instrument”,
but concludes:
“Data flows from the EEA to the UK may be restricted post-exit, but that is as a consequence of the EU leaving the EU, not as a result of this instrument”.
It is impossible to separate the instrument from the fact that we are leaving the EU. The noble Baroness put her finger on a very important point, which is that  if we leave the EU with a deal on the basis recommended by the Prime Minister, the impact might be radically different from that envisaged under the instrument, for two reasons. First, there will be a transition period in which nothing changes but, secondly, the political declaration heralds negotiations on a whole set of issues, including trade and data flows, which might well lead to our continuing in the existing GDPR regime. So the last sentence of paragraph 12 is not true. It is not true to say that the issue of data flows and the regulation of data is dependent on the UK leaving the EU, not as a result of the instrument. There is a crucial difference between leaving the EU with a deal—in particular, with a deal that maintains the status quo—and without a deal.
When the noble Lord, Lord McNally, cited one of his expensive lawyers, who had suggested that there may be additional complexity—